How Solar Panels Are Made: From Polysilicon to Module and Inverter

Solar panels are made by refining quartz into metallurgical silicon and then into ultra pure polysilicon, melting that into a single crystal ingot, and slicing the ingot into wafers thinner than a credit card with diamond coated wire. Each wafer is etched, doped, passivated and printed with metal contacts to become a cell; cells are soldered into strings, laminated between glass and polymer, framed and tested as a module. An inverter, which is a power electronics box running firmware, then converts the module's direct current into alternating current that meets the grid's rules.

This post goes one level deeper than our semiconductor explainer, which follows silicon into chips, and our overview of fuel cells, batteries, engines and solar for data centers. It covers the chemistry and machines at each step, the cell architectures that now compete (PERC, TOPCon, heterojunction and back contact), the IEC tests a module must pass, worked numbers for efficiency, heat and ageing, how inverters and their firmware work, what the IEEE 1547 grid rules ask of them, and why their communications have become a cybersecurity topic for the US Department of Energy and NIST. It closes with a practical firmware routine for homeowners and installers.

Manufacturers keep yields and many process recipes private. Where no primary source publishes a number, we say so, and arithmetic we add ourselves is labelled illustrative.

Key takeaways

• Polysilicon for solar is 8N to 11N pure (99.999999 percent or better), refined from 2N metallurgical silicon. The US Department of Energy (DOE) reported in February 2022 that the Siemens chemical vapor deposition process held more than 90 percent of the market.
• Monocrystalline ingots are pulled by the Czochralski method from silicon melted at 1,410 °C, at about 1 mm per minute, so a single ingot takes about four days.
• Diamond coated wire slices the ingot into wafers. DOE put typical thickness at 180 micrometers in 2022 and said about a third of the ingot became sawdust; Fraunhofer ISE's July 2026 report cites 140 micrometer wafers.
• n-type TOPCon has displaced p-type PERC as the dominant cell. Fraunhofer ISE, citing the ITRPV roadmap, puts n-type wafers at 86 percent of 2025 production.
• Modules are qualified to IEC 61215 (design and durability) and IEC 61730 (safety). The current editions are IEC 61215-2:2021 and IEC 61730-1:2023.
• Heat costs power: at a typical temperature coefficient of minus 0.35 percent per °C, a module running at 60 °C loses about 12 percent of its rated output.
• Inverters are networked computers with grid duties. IEEE 1547-2018 sets their interconnection behaviour, IEEE 2030.5-2023 is a common utility protocol, and NIST IR 8498 (December 2024) gives seven cybersecurity guidelines for home and small business inverters.
• DOE's solar office says smaller PV systems currently have no cybersecurity standards of their own, which makes the owner's and installer's update habits matter.

Quartz to grid: the step table

This is the map for the rest of the post. Energy and time figures come from the DOE supply chain assessment unless noted; no manufacturer publishes per stage yields, so the checks column names what is inspected rather than inventing a pass rate.

A dated timeline of the milestones that shaped today's panels

Every date below was checked against the source linked in the Sources section.

How is quartz turned into solar grade polysilicon?

Silicon is the second most abundant element in Earth's crust, but it never occurs pure. It is locked up with oxygen as silica, and the job of the first two factories is to take the oxygen away and then take everything else away.

From quartz to metallurgical silicon

DOE's 2022 deep dive explains that metallurgical grade silicon (MGS, also sold as silicon metal) is made from high grade quartz, and that producers must be selective because some impurities hurt solar performance and are very hard to remove later. Ordinary sand is quartz, but it usually carries too many impurities. Quartz comes either from riverbeds, where mountain ranges have broken down, or from underground veins, where fine quartz dust is a serious inhalation hazard for miners.

The quartz goes into an electric arc furnace with carbon from low ash coal and woodchips. Carbon pulls the oxygen off the silicon, leaving molten silicon and carbon monoxide that is later oxidised to carbon dioxide. This is the most electricity hungry step in the chain: DOE gives 10 to 15 MWh for every tonne of MGS. The product is about 99 percent silicon, which the industry calls 2N ("two nines"). That is good enough for aluminium alloys and silicones, but nowhere near good enough for a solar cell, where a few parts per billion of the wrong metal can trap the electrons the cell is trying to collect.

From MGS to polysilicon: the Siemens and FBR processes

Polysilicon is MGS refined to between 8N and 11N, that is 99.999999 to 99.999999999 percent silicon. DOE says solar is the main buyer, at more than 80 percent of demand, with chips and electronics taking the rest.

Two routes dominate. In the Siemens process, which DOE credits with more than 90 percent of the market, silicon is first converted into a gas such as trichlorosilane or silane, which can be purified by distillation far more effectively than a solid. The purified gas then flows over thin silicon filaments heated inside bell shaped reactors, and pure silicon deposits on them layer by layer. Unreacted compounds are recovered and recycled. The finished product is a set of U shaped rods, which are broken into chunks and sealed in plastic bags under an inert gas such as argon.

In the fluidized bed reactor (FBR) route, at 3 to 5 percent share in DOE's figures, small silicon beads float on an upward flow of silane and hydrogen inside an inverted cone. Silicon deposits on the beads until they are heavy enough to fall out the bottom as granules. Granules pour into crucibles more easily than chunks and suit continuous Czochralski growth, though buyers have to weigh impurity differences between suppliers.

How are ingots and wafers produced?

Czochralski growth

DOE describes two ways to turn polysilicon into wafers. The one that now dominates is the Czochralski (Cz) process for monocrystalline wafers. Polysilicon chunks, plus a measured dose of dopant, are melted at 1,410 °C in a quartz crucible designed to keep contamination down. A small seed crystal is dipped into the melt and slowly withdrawn while rotating; silicon atoms freeze onto the seed in the same crystal orientation, and a cylindrical single crystal ingot grows downward from it.

The numbers in DOE's assessment show how far the industry scaled. A typical ingot in 2010 weighed about 140 kg and was cropped into blocks 1.5 to 2.0 m long with a 156 mm flat edge. By 2020 typical ingots weighed 400 to 450 kg, and ingots over 800 kg had been shown at pilot scale. DOE gives a typical growth rate of 1 mm per minute and about four days per ingot.

Illustrative check: a 5.5 m ingot grown at 1 mm per minute takes 5,500 minutes, which is about 92 hours or 3.8 days, matching DOE's "about 4 days". Growth time is one reason ingot pulling takes more than 70 percent of the energy needed to make a wafer, according to the same report.

The older directional solidification route melts polysilicon in a square crucible and cools it from the bottom, producing a block of centimetre sized crystals for multicrystalline wafers. It is faster (about three days per ingot including cool down) but gives lower efficiency cells. Fraunhofer ISE's 2026 report shows multicrystalline production at essentially zero in 2025: 690 GWp of the 706 GWp produced was monocrystalline silicon, with 16 GWp of thin film.

Bigger wafers: M10 and G12

In 2020 the industry moved toward two larger standards, according to DOE: M10, a 182 by 182 mm pseudo square with a 260 mm diagonal, and G12, a 210 by 210 mm full square with a 297 mm diagonal. Larger wafers mean more power per cell and per module for roughly the same handling cost. Fraunhofer ISE notes that larger wafers allow modules of up to 750 W with the same cell count.

Diamond wire sawing

Squared ingots are sliced into wafers on wire saws. DOE explains that a diamond coated wire wraps around the ingot many times so that all wafers are cut in parallel at once, and it put typical wafer thickness at 180 micrometers in 2022, with about one third of the ingot lost as silicon sawdust (kerf). Fraunhofer ISE's 2026 report cites 140 micrometer wafers made with diamond wire saws.

Thinner wafers and narrower kerf are why the silicon needed per watt has fallen so far. Fraunhofer ISE reports silicon use fell from about 16 grams per watt peak in 2004 to about 2.0 grams in 2024, helped by higher efficiency, thinner wafers, larger ingots and recycling of kerf silicon.

Illustrative arithmetic: a 570 W module at 2.0 g per watt uses about 1.14 kg of polysilicon. The same module at 2004's 16 g per watt would have needed about 9.1 kg, eight times as much.

How is a solar cell made?

DOE summarises cell making as a series of wet chemical treatments, high temperature gas diffusions, coating depositions and metallisation steps, with inspection at the start of the line and electrical testing at the end to discard bad cells. The details depend on the architecture. The steps below are common to most crystalline silicon cells; the architectures then differ in how they handle the surfaces and contacts.

Saw damage removal and texturing

Sawing leaves a damaged surface layer, so wafers are first etched in a chemical bath. A second etch exploits the crystal structure of monocrystalline silicon to leave a surface of microscopic pyramids. Light that bounces off one pyramid face usually hits another, so more of it enters the silicon.

Doping and the p-n junction

A cell needs a junction between p-type and n-type silicon to separate the electrons and holes that sunlight creates. Wafers come pre-doped from the ingot, and the opposite type is formed near one surface by diffusion in a hot furnace. In Fraunhofer ISE's 2020 TOPCon process, for example, an n-type wafer received a boron emitter by atmospheric pressure diffusion from boron tribromide. Older p-type cells did the reverse with phosphorus. After diffusion, an edge isolation step stops the two sides shorting around the wafer edge.

Passivation and anti reflection coating

Every surface of a silicon crystal has broken bonds where charge carriers recombine and are lost. Passivation layers tie up those bonds. Common materials are aluminium oxide, deposited by atomic layer deposition, and hydrogen rich silicon nitride, deposited by plasma enhanced chemical vapor deposition (PECVD). Silicon nitride does double duty as the anti reflection coating that gives cells their blue or black tint, and it releases hydrogen that heals defects during firing.

Metallisation and firing

Contacts are printed onto the cell as a fine grid of metal paste through a screen. Fraunhofer ISE's TOPCon cells used a silver aluminium paste on the front and silver on the rear, then passed through an industrial conveyor furnace at peak temperatures of 800 to 840 °C, where the paste burns through the nitride to touch the silicon. Silver is one of the most expensive materials in a module, and Fraunhofer ISE lists multi busbar designs, busbarless cells and replacing silver with copper or aluminium as ways to cut it.

Test and binning

Each finished cell is flashed under a calibrated light pulse, its current voltage (IV) curve is measured, and it is sorted into a bin by power and current so that matched cells end up in the same module.

PERC, TOPCon, heterojunction and back contact: how do they differ?

All four start from a crystalline wafer. They differ in how they stop carriers recombining at the surfaces and contacts, which is where most of the remaining efficiency is lost.

PERC

Passivated emitter and rear cell (PERC) added a passivating dielectric layer (typically aluminium oxide capped with silicon nitride) to the rear of the older aluminium back surface field (Al-BSF) cell, with laser openings where the metal touches the silicon. DOE's 2022 report described Al-BSF as dominant before 2018 and PERC as dominant at the time of writing, made with a process like Al-BSF plus a few more steps. That made it an easy upgrade for existing lines, and PERC was the workhorse of the late 2010s.

TOPCon

Tunnel oxide passivated contact (TOPCon) cells put an extremely thin silicon oxide layer on the rear, thin enough for carriers to tunnel through, capped with heavily doped polycrystalline silicon. The stack passivates the surface and still conducts, so the rear can be contacted without the recombination a direct metal contact causes. Fraunhofer ISE's 2020 conference paper lays out an industrial sequence: saw damage removal, texturing and cleaning; boron emitter diffusion; wet chemical edge isolation; thermal growth of the tunnel oxide; deposition of 150 nm of phosphorus doped amorphous silicon by PECVD; removal of the unwanted wrap around from the front; a furnace anneal to activate the contact (turning the layer polycrystalline); aluminium oxide and silicon nitride passivation on the front and nitride on the rear; screen printed silver contacts; and firing. The paper notes that low pressure CVD was the common industrial deposition method and that poly silicon contacts had taken laboratory cells past 26 percent. Fraunhofer ISE's July 2026 report says n-type TOPCon "has become dominant".

Heterojunction

Silicon heterojunction (HJT) cells sandwich the crystalline wafer between very thin layers of hydrogenated amorphous silicon, an intrinsic layer for passivation and doped layers to form the junction and back field, then add a transparent conductive oxide so current can flow sideways to the metal grid. Because amorphous silicon is damaged by heat, the whole flow stays at low temperature; a 2006 NREL paper describes amorphous silicon back contacts "deposited entirely at low temperature" below 250 °C. That rules out high temperature fired pastes and usually means separate equipment from PERC and TOPCon lines.

Back contact

Back contact cells, including interdigitated back contact (IBC) designs, move both the positive and negative contacts to the rear in interleaved fingers. The front has no metal at all, so it shades nothing. The cost is a more complex rear patterning process. Back contact structures can be combined with TOPCon or heterojunction style passivating contacts.

Comparison table

We have deliberately left out a "typical efficiency" column. Production efficiencies vary by manufacturer and change every few months, and the record figures on the NLR chart are laboratory results on small cells, not what a production line averages.

How are cells strung, laminated and framed into a module?

DOE's assessment describes module assembly in one long sentence that is worth unpacking. Cells are connected into strings with metal ribbons; parallel strings are arranged into an array and joined with more ribbons; the array is laid on a sheet of encapsulant on top of glass; a second sheet of encapsulant and a backsheet or rear glass go on top; and the stack is laminated, meaning it is heated under vacuum so the thermoplastic encapsulant melts and seals the cells between front and back.

The materials, per DOE:

• Front glass: typically 3.2 mm rolled glass, tempered, anti reflection coated and slightly dimpled on one side so the encapsulant grips it.
• Encapsulant: ethylene vinyl acetate (EVA) is used mainly for single sided modules, polyolefin elastomer (POE) mainly for bifacial and thin film modules.
• Backsheet: usually three polymer films laminated together; double glass modules replace it with a second pane.
• Junction box: the ribbons pass through the back to a box containing bypass diodes, which let current flow around a shaded or damaged cell string, and which is the connection point for the module's cables.
• Frame: usually extruded aluminium, though frameless glass glass designs exist.

Factories image every string and finished laminate with electroluminescence (EL), which works like an X-ray for cells: current is pushed through the cells in the dark so they glow in infrared, and cracks or dead areas show up as dark patches. The final module flash test measures its IV curve under standard test conditions, and that measured power, sorted into a power class, is what goes on the label.

Fraunhofer ISE lists lead free solders, antimony free glass, fluorine free backsheets and replaceable bypass diodes among the changes that would make modules easier to recycle and repair.

What tests do IEC 61215 and IEC 61730 apply?

Two IEC families define whether a module design is fit to sell in most markets. Both come from IEC technical committee TC 82, Solar photovoltaic energy systems.

IEC 61215, design qualification and type approval. The IEC webstore describes IEC 61215-2:2021 (edition 2.0, published 24 February 2021) as laying down requirements for the design qualification of terrestrial modules "suitable for long-term operation in open-air climates", for crystalline silicon and thin film alike. Part 1 sets the general requirements and Part 2 the test procedures. The test sequences stress samples with thermal cycling, damp heat, humidity freeze, ultraviolet exposure, mechanical load, hail impact and hot spot tests, and measure power before and after to see how much was lost. The pass criteria, cycle counts and sample sizes are in the standard itself, which is a paid document; we do not reproduce them here.

IEC 61730, safety qualification. IEC 61730-1:2023 (edition 3.0, published 13 September 2023) sets the construction requirements so modules operate safely electrically and mechanically, covering protection against electric shock, fire and injury from mechanical and environmental stress. IEC 61730-2 holds the matching test requirements. The IEC listing notes it applies to modules whose 98th percentile operating temperature is 70 °C or less, with guidance for hotter mounting in a separate technical specification.

These are type tests on a design, not tests of every module off the line, and passing them screens out designs that fail early rather than guaranteeing a lifetime. Long term ageing is measured in the field, which is the next section.

What are module efficiency, temperature coefficient and degradation?

Efficiency

Module efficiency is the electrical power out divided by the sunlight power falling on the module, measured at standard test conditions (STC): 1,000 W per square metre of light with a standard spectrum, and cells at 25 °C. NLR's efficiency chart notes that its record entries must be measured against the reference spectrum in IEC 60904-3 edition 2 or ASTM G173 at 25 °C.

Fraunhofer ISE's July 2026 report gives the state of play: the record lab cell efficiency for monocrystalline silicon is 28.1 percent, the best lab silicon module reaches 26.0 percent, and commercial monocrystalline modules have climbed from about 17 percent to just under 25 percent over a decade. Its shipment weighted average for silicon modules was 22.7 percent in the fourth quarter of 2024.

Worked example 1: computing efficiency from a data sheet (illustrative numbers). A module measures 2,278 by 1,134 mm and is rated 570 W.

• Area: 2.278 m × 1.134 m = 2.583 m².
• Sunlight at STC: 2.583 m² × 1,000 W/m² = 2,583 W.
• Efficiency: 570 W ÷ 2,583 W = 0.2207, or about 22.1 percent.

That sits right on Fraunhofer ISE's average for late 2024. If a data sheet claims an efficiency that does not match its own power and dimensions by this calculation, ask why.

Temperature coefficient

Silicon cells lose voltage as they warm up, so power falls. The temperature coefficient of power gives the percentage lost per degree Celsius above 25 °C. NLR's PVWatts help page uses minus 0.37 percent per °C for its "standard" crystalline module type, minus 0.35 for "premium" crystalline and minus 0.32 for thin film. On a sunny roof, cells commonly run 20 to 40 °C above air temperature.

Worked example 2: a hot afternoon. The same 570 W module, cells at 60 °C, so 35 °C above STC.

• With minus 0.35 percent per °C: loss = 35 × 0.35 = 12.25 percent. Output = 570 × (1 minus 0.1225) = 500.2 W.
• With minus 0.37 percent per °C: loss = 35 × 0.37 = 12.95 percent. Output = 570 × (1 minus 0.1295) = 496.2 W.
• With minus 0.32 percent per °C: loss = 35 × 0.32 = 11.2 percent. Output = 570 × (1 minus 0.112) = 506.2 W.

The difference between the best and worst coefficient here is 10 W per module, or about 300 W on a 30 module roof at peak heat. It is why ventilation behind the module matters, and why a lower coefficient can matter more than a slightly higher STC rating in a hot climate. PVWatts' own help notes that a "standard" module can model slightly higher annual output than a "premium" one in some conditions.

Degradation

Modules lose output slowly. NLR's PV Lifetime Project says modules typically lose less than 1 percent of performance a year, which is often within measurement uncertainty for the first several years. The most cited figure is from Jordan and Kurtz's review of nearly 2,000 published degradation rates, which found a median of 0.5 percent a year.

Worked example 3: 25 years of ageing. Start at 570 W and apply the 0.5 percent median.

• Linear model (the way most warranties are written): 570 × (1 minus 0.005 × 25) = 570 × 0.875 = 498.8 W after 25 years.
• Compounding model: 570 × 0.995^25 = 570 × 0.8822 = 502.9 W.

Both land near 88 percent of the original rating. A module degrading at 1 percent a year would be at 75 to 78 percent by the same point, which is why the degradation clause in a warranty is worth reading as carefully as the headline wattage.

How do string inverters, microinverters and optimisers convert DC to AC?

Modules produce direct current. Homes and grids run on alternating current. The inverter bridges the two, and it decides, many thousands of times a second, how hard to pull on the modules and what waveform to push into the grid.

DOE's solar office describes the two main designs plainly. String inverters connect a set of panels, a string, to one inverter that converts the whole string's power to AC; they are cost effective, but shading or a problem on one panel reduces the whole string's output. Microinverters sit on every panel, so shading or damage on one does not affect the others, though they can cost more. A third design, DC optimisers, puts a small DC to DC converter on each module to adjust its operating point and then feeds a central string inverter. Hybrid inverters add a battery port and can charge storage over DC or after conversion to AC. (For how the battery itself is built, see our post on how lithium ion batteries are made.)

What happens inside

1. Maximum power point tracking (MPPT). A module's power depends on the voltage it is held at. The controller constantly nudges the input voltage and watches power, settling at the peak. Shade and temperature move that peak all day, so MPPT runs continuously.
2. DC to DC stage. Many designs boost the module or string voltage to a stable internal DC bus.
3. DC to AC bridge. Power transistors switch the DC bus on and off at high frequency using pulse width modulation, and filters smooth the result into a sine wave synchronised to the grid. DOE notes that insulated gate bipolar transistors (IGBTs) are used in higher power PV inverter power blocks, and silicon carbide devices are increasingly common.
4. Grid synchronisation and protection. The controller locks to grid voltage and frequency, monitors both, and disconnects within set times if they go out of bounds or if the grid goes down (anti islanding), so line workers are not hurt by a "dead" line that is still being fed.
5. Grid support. Modern "smart" inverters can ride through short disturbances instead of dropping off, adjust reactive power to help hold voltage, and curtail output on command. DOE's inverter page also describes grid forming inverters that can set the grid's voltage and frequency themselves, which allows black start of a microgrid; conventional grid following inverters need the grid's signal to follow.

What firmware do inverters run?

An inverter has at least two kinds of software, and often three:

• Control firmware on a microcontroller or digital signal processor runs the MPPT loop, the switching pattern, protection limits and the grid support functions. This is real time code where a bug can trip the inverter or, worse, push power outside safe limits.
• Communications firmware handles the local interfaces (often Modbus over RS-485 or Ethernet), Wi-Fi or cellular links, the inverter's local web or app interface, and protocols for utilities and aggregators.
• Gateway software. Many systems add a separate gateway or monitoring box, often a small embedded computer, that collects data from every inverter or microinverter, talks to the manufacturer's cloud and relays commands and updates.

The communications and gateway layers are where general purpose software appears: embedded operating systems, network stacks, web servers, TLS libraries and JSON parsers, much of it open source. DOE's 2022 supply chain assessment notes that the application specific chips and power semiconductors in inverters are almost entirely produced in Asia, and frames communications and cybersecurity as a competitive issue, with buyers valuing inverters with "a reduced risk of containing embedded malware".

A 30 module microinverter system has 30 inverters and a gateway, each with a firmware version to track.

What do grid codes like IEEE 1547 require of inverters?

In the US, IEEE 1547-2018, the Standard for Interconnection and Interoperability of Distributed Energy Resources with Associated Electric Power Systems Interfaces, is the baseline. IEEE SA lists it as approved on 15 February 2018, published 6 April 2018, superseding IEEE 1547-2003, with amendment 1547a-2020. Its abstract says it covers the technical specifications for, and testing of, interconnection and interoperability between utility systems and distributed energy resources (DER): performance, operation, testing, safety and maintenance, including response to abnormal conditions, power quality, islanding, and test requirements for design, production, installation evaluation, commissioning and periodic tests. It is written for 60 Hz systems and applies to synchronous machines, induction machines and inverters alike.

In practice, 1547-2018 changed inverters from devices that simply disconnected at the first sign of trouble into devices that are expected to:

• Ride through short voltage and frequency disturbances rather than all tripping at once, which on a grid with a lot of solar could turn a small disturbance into a large one.
• Support voltage by absorbing or injecting reactive power, using modes such as fixed power factor or volt var.
• Respond to frequency by changing active power.
• Accept settings chosen by the utility, within ranges the standard defines.
• Expose a local communication interface so a utility or aggregator can read status and change settings. Industry guidance on the standard describes three protocols that can satisfy this interface: IEEE 2030.5, IEEE 1815 (DNP3) and SunSpec Modbus, with the utility choosing which applies.

Conformance testing is defined in the companion standard IEEE 1547.1, and many US jurisdictions reference certification of inverters to a matching product safety standard before interconnection.

IEEE 2030.5 and SunSpec Modbus

IEEE 2030.5-2023, the Standard for Smart Energy Profile Application Protocol, was approved on 6 December 2023 and published on 11 December 2024, superseding the 2018 edition. IEEE describes it as an application layer over TCP/IP that lets utilities manage end user energy, including demand response, load control, time of day pricing, management of distributed generation and electric vehicles. It follows a RESTful architecture using IETF protocols such as HTTP and draws on IEC 61968 and IEC 61850 information models. In other words, it is a web style API between utility servers and DER, which brings the familiar strengths and risks of web software: certificates, TLS, parsing and authentication.

SunSpec Modbus defines standard register maps ("models") on top of the decades old Modbus protocol so that monitoring tools can read any compliant inverter the same way. The SunSpec Alliance publishes its model definitions in an Apache 2.0 licensed repository; the Common model (model 1) "must" be the first model on every SunSpec compliant device and holds manufacturer, model, options, version and serial number. Plain Modbus has no built in authentication or encryption, which is why NIST and DOE guidance focuses on keeping these interfaces off untrusted networks.

California Rule 21 as an example of a state process

States and utilities decide how 1547 is applied. California's Public Utilities Commission runs a Smart Inverter Working Group that meets every two weeks on interconnection, communications and cybersecurity, and in 2025 its recorded sessions included an overview of IEEE 2030.5-2023 and of the DNP3 profile for DER. On 20 August 2025 the CPUC opened rulemaking R.25-08-004 to refine Rule 21 interconnection. If you install in a regulated market, the utility's interconnection handbook, not the inverter's default menu, decides which grid profile and communication settings are required.

Why are inverter communications a security topic?

A solar inverter is a networked device that can switch real power on and off. That alone puts it in the same family as industrial control systems, but with three differences: there are millions of them, they belong to homeowners rather than utilities, and many are managed through manufacturer clouds.

NIST IR 8498 sets out the stakes directly. It says compromising a single home or small business inverter would have minimal grid impact today, but as utilities depend more on rooftop solar at peak, attacks built to compromise many inverters "may have significant impacts". It adds that if vendors share software across product lines, weaknesses found in residential inverters could be used against larger commercial ones. For the owner, NIST lists loss of financial benefit if the inverter disconnects, possible damage to home equipment if output is driven outside safe limits (harmonic distortion, overvoltage, wrong frequency), and the system failing when it is most needed, such as in an outage. NIST's working assumption is blunt: in the absence of proven correct software, defects should be assumed to exist.

DOE's October 2022 DER cybersecurity report adds the fleet view. It notes that DER deployment was expected to grow from about 90 GW to about 380 GW by 2025, with nearly half being solar PV, and lists attack patterns including DER ransomware, DER botnets, worms that move from a device to an aggregator's management system, and DER supply chain compromise, where an attack on an aggregator or vendor influences every DER that "take direction or receive updates" from it. It likens patching DER to a mobile carrier pushing a fix to phones across thousands of sites, with some updates likely to fail.

NIST IR 8498 was informed by a review of smart inverter vulnerabilities in the National Vulnerability Database. Its appendix lists entries going back several years, including authentication bypasses, information disclosure through unauthenticated web requests, passwords stored in readable files and a disputed report about crafted firmware being accepted. We are not repeating vendor names here; the point is that these are ordinary web and embedded software flaws, the same classes found in routers and cameras. For a vendor case study in the same space, see our post on lessons from solar installer app and gateway vulnerabilities.

What did NREL, NLR and DOE publish about DER cybersecurity?

The DOE laboratory in Golden, Colorado, whose older reports carry the NREL name and whose web pages now appear under the National Laboratory of the Rockies (NLR), leads much of DOE's PV research. On cybersecurity, the public record we could verify is mostly published through DOE program pages and joint reports:

• DOE Solar Energy Technologies Office (SETO), Solar Cybersecurity. SETO says large scale solar must comply with critical infrastructure protection standards before operating, but "smaller PV systems and other DERs currently do not have any cybersecurity standards to follow", and are usually connected by their owners to the internet for monitoring and control. SETO funded Sandia's 2017 Roadmap for Solar Cybersecurity, and its FY2022 to 2024 lab call includes the Securing Solar for the Grid (S2G) project, which is building cybersecurity standards and certifications, network monitoring tools, risk assessments and training for DER and inverter based resources.
• DOE CESER and EERE, Cybersecurity Considerations for Distributed Energy Resources on the U.S. Electric Grid (October 2022). Recommendations for the DER industry, utilities and government, covering grid automation trends, supply chain threats and treating cybersecurity as a design requirement, with the growth and attack scenarios summarised above.
• NIST IR 8498 (December 2024). Not a DOE document, but the most practical: seven guidelines for owners and installers and a capability list for manufacturers, based on testing five example inverters.

The seven NIST IR 8498 guidelines

NIST's testing found that all five inverters supported some role based access, with three offering full role based access control and two offering one account per role. Its manufacturer recommendations go further than many current products: automatic updates that are configurable, owner notification after an update, detection of failed updates with rollback to known good software, deferral of updates when operating conditions make it unsafe, and updates to safety critical control functions only through a local interface on the inverter. NIST notes that the automatic update recommendation describes an ideal, and some inverters still need the owner to act.

How should a homeowner or installer manage inverter and gateway firmware?

The routine below follows NIST IR 8498's guidelines and DOE's fleet observations. It uses only read operations against equipment you own or manage. It does not change grid settings, which in most markets must match what the utility approved.

Warning before you start. A firmware update can interrupt generation, reset settings, or in rare cases leave a device unable to start. Never change grid profile, ride through or power settings without the utility's approved values; doing so can breach your interconnection agreement. Never write to Modbus registers on a live inverter unless the manufacturer's documentation tells you to. Before each step that touches a device, confirm the IP address belongs to your inverter or gateway (check the router's DHCP table and the device's label or app) so you do not probe someone else's equipment.

Step 1: build an inventory

List every device with firmware: each inverter or microinverter, any optimisers, the gateway or monitoring unit, battery systems and the energy management controller. Record manufacturer, model, serial number, current firmware version, how it updates, and the vendor's support end date if published. Installers should keep this per site.

site_id,device_role,manufacturer,model,serial,firmware,update_path,support_end
S-0142,gateway,ExampleCo,GW-2,G2-001942,4.2.1,cloud-auto,2031-12
S-0142,inverter,ExampleCo,SI-7600,SI7-55810,3.18.0,via-gateway,unknown
S-0142,battery,ExampleCo,BAT-13,B13-20077,2.4.6,installer-tool,2030-06

Step 2: read the version from the device, not from memory

The app usually shows firmware versions. On a SunSpec Modbus inverter on your own network, you can also read the Common model, which holds manufacturer, model and version. This read only Python example uses the open source pymodbus library pinned to a known version; confirm the IP, port and unit ID from the inverter's manual first.

python3 -m venv sunspec-env
. sunspec-env/bin/activate
pip install "pymodbus==3.6.9"

# read_sunspec_common.py : READ ONLY. Confirm INVERTER_IP is your own device first.
from pymodbus.client import ModbusTcpClient

INVERTER_IP = "192.168.50.20"   # check against your router's DHCP table
UNIT_ID = 1                      # from the inverter manual
BASE = 40000                     # common SunSpec base register; confirm in the manual

def regs_to_str(regs):
    raw = b"".join(r.to_bytes(2, "big") for r in regs)
    return raw.split(b"\x00")[0].decode("ascii", "replace").strip()

client = ModbusTcpClient(INVERTER_IP, port=502, timeout=3)
client.connect()
rr = client.read_holding_registers(BASE, 68, slave=UNIT_ID)
client.close()
if rr.isError():
    raise SystemExit(f"Read failed: {rr}")
r = rr.registers
assert regs_to_str(r[0:2]) == "SunS", "No SunSpec marker at this base address"
# Common model: ID, L, Mn(16), Md(16), Opt(8), Vr(8), SN(16), DA
print("Model ID:     ", r[2])
print("Manufacturer: ", regs_to_str(r[4:20]))
print("Model:        ", regs_to_str(r[20:36]))
print("Version:      ", regs_to_str(r[44:52]))
print("Serial:       ", regs_to_str(r[52:68]))

If the read fails, stop. Many inverters disable Modbus TCP by default, which is the safer state; do not enable it just for this.

Step 3: check what the devices expose on your network

From a computer on the same network, list which ports are open on your own inverter and gateway. Modbus TCP normally uses port 502 and DNP3 port 20000.

# Confirm the address belongs to your device before scanning it.
nmap -Pn -p 22,23,80,443,502,1883,8080,8443,20000 192.168.50.20

Anything you did not expect, such as Telnet on port 23 or Modbus reachable from the main home network, is a reason to disable the feature (NIST Guideline 6) or move the device to a separate network (Guideline 7).

Step 4: separate the inverter's network

Put the inverter and gateway on a guest network or a separate VLAN that can reach the internet but cannot reach laptops, phones or NAS drives, and that those devices cannot reach. NIST IR 8498 suggests separate logical networks on the home router, and says connections used to talk to the utility or manufacturer should not be reachable from other devices on the local network.

Step 5: decide the update policy

• If the system supports automatic updates and the vendor documents that they are signed and verified, leave them on; NIST notes manual updates often are not installed quickly enough.
• If updates are installer driven, agree a maximum time to apply security updates in the service contract, and ask how the installer is told about them.
• If updates come as files (USB stick or local upload), download only from the manufacturer's site over HTTPS and compare the published checksum before use. NIST flags USB style updates on older inverters as carrying their own risks.

# Compare the downloaded file's hash with the value on the vendor's download page.
shasum -a 256 inverter-fw-3.19.0.bin

Step 6: back up before and after

Export the configuration (NIST Guideline 5) before updating, and again afterwards. Note the grid profile name and key settings so they can be checked against the utility's approved values if anything resets.

Step 7: verify after the update

Re-read the version (step 2), confirm generation in the app over the next sunny day, and check the event log shows the update with its source (NIST Guideline 3). If generation drops or a grid fault appears, contact the installer; do not try to change grid settings yourself.

Step 8: track end of support

NIST is explicit that manufacturers stop producing patches for discontinued devices and that owners should replace them with current models as soon as possible. Put the support end date in the inventory and plan for it the way you plan for a roof or a water heater.

For installers and fleet operators

The same steps scale with a script that compares the inventory against a minimum version per model. This is a small example using the CSV above and a policy file you maintain:

# check_fleet.py : flag devices below the minimum firmware you have approved.
import csv
from packaging.version import Version

MIN_VERSION = {("ExampleCo", "SI-7600"): "3.19.0", ("ExampleCo", "GW-2"): "4.3.0"}

with open("fleet.csv", newline="") as f:
    for row in csv.DictReader(f):
        key = (row["manufacturer"], row["model"])
        if key in MIN_VERSION and Version(row["firmware"]) < Version(MIN_VERSION[key]):
            print(f'{row["site_id"]} {row["device_role"]} {row["serial"]}: '
                  f'{row["firmware"]} below {MIN_VERSION[key]}')

DOE's report points out that aggregators may need to coordinate fleet updates with grid operators because a share of failed updates can take output offline. Stage updates across sites rather than updating every site on the same morning.

Common mistakes

• Treating the inverter as an appliance. It is a networked computer with a 20 year life. Leaving it on factory credentials, on the main home network, with every service enabled, is the pattern NIST IR 8498 was written to stop.
• Changing grid settings to fix a nuisance trip. Ride through, voltage and power settings are agreed with the utility. Changing them can breach the interconnection agreement and defeat the grid support 1547 was written to provide.
• Comparing modules on STC watts alone. A slightly lower rating with a better temperature coefficient and degradation warranty can produce more energy over 25 years in a hot climate, as the worked examples show.
• Reading lab records as product specs. Record cell efficiencies on the NLR chart are independently confirmed results on small research devices. Production modules sit several points lower.
• Assuming a certificate covers every module. IEC 61215 and IEC 61730 qualify a design. Material or supplier changes after certification can change real durability.
• Enabling Modbus TCP for convenience. It has no authentication or encryption of its own. Enable it only when needed and only on a separate network.
• Updating every site at once. Fleet operators who push one firmware to every site on the same day risk a correlated failure, the scenario DOE's DER report describes.
• Ignoring end of support. An inverter that no longer receives updates keeps working, so it is easy to forget it is accumulating unfixed flaws.

FAQ

How are solar panels made, step by step?

Quartz is smelted to metallurgical silicon, refined to polysilicon, melted and pulled into a single crystal ingot, sliced into wafers, processed into cells (texture, dope, passivate, coat, print contacts, fire), soldered into strings, laminated between glass and encapsulant, framed, fitted with a junction box and flash tested.

What is the difference between polysilicon and monocrystalline silicon?

Polysilicon is the ultra pure feedstock made of many small crystals, produced as rods or granules. Monocrystalline silicon is what you get after melting polysilicon and growing a single continuous crystal from a seed by the Czochralski method. Wafers for modern cells are cut from those monocrystalline ingots.

Why are solar wafers cut with diamond wire?

A diamond coated wire wrapped many times around the ingot cuts every wafer at once and allows thinner wafers with less silicon lost as sawdust. DOE said about a third of the ingot was still lost as kerf in 2022, and Fraunhofer ISE credits diamond wire and thinner wafers for cutting silicon use to about 2 grams per watt.

What is the difference between PERC and TOPCon solar cells?

PERC adds a passivating layer to the rear of a mostly p-type cell with local metal contacts. TOPCon, usually on n-type wafers, uses an ultra thin tunnel oxide plus doped polysilicon so the whole rear is passivated and still conducts. Fraunhofer ISE reports TOPCon has become the dominant technology.

Are heterojunction solar panels better than TOPCon?

They use different routes to the same goal of reducing recombination. Heterojunction cells use thin amorphous silicon layers and a low temperature process; TOPCon uses a high temperature oxide and polysilicon contact compatible with existing fired metallisation. Compare actual module data sheets, including temperature coefficient and warranty, rather than the cell type alone.

What do IEC 61215 and IEC 61730 certify?

IEC 61215 qualifies a module design for long term outdoor operation through stress sequences such as thermal cycling and damp heat. IEC 61730 qualifies its construction and testing for electrical, fire and mechanical safety. Both apply to a design, not each module.

How much power does a solar panel lose when it is hot?

About 0.3 to 0.4 percent per °C above 25 °C for crystalline silicon. NLR's PVWatts uses minus 0.35 to minus 0.37 percent per °C for crystalline modules, so a module at 60 °C produces around 12 to 13 percent less than its label.

How fast do solar panels degrade?

A widely cited review of nearly 2,000 measurements found a median of 0.5 percent a year. NLR says modules typically lose less than 1 percent a year. At 0.5 percent, a module keeps about 88 percent of its rating after 25 years.

Do solar inverters get firmware updates?

Yes. Most smart inverters and gateways receive updates from the manufacturer's cloud, through an installer tool or from a local file. NIST IR 8498 recommends updating regularly, verifying the source and integrity of updates, and replacing devices once vendor support ends.

Can a solar inverter be hacked?

Inverters have had published vulnerabilities, and NIST and DOE both treat their communications as a security risk, mostly through ordinary software flaws, weak default credentials and exposed interfaces. Changing default passwords, separating the inverter's network, disabling unused features and keeping firmware current reduce the risk.

Where Safeguard fits, honestly

Safeguard does not make, test or analyse solar modules or inverters. It does not scan inverter firmware, verify firmware signatures, generate a hardware bill of materials, manage devices or monitor grid traffic, and its models are single purpose security models for software, not tools for materials science or power engineering. The fit is narrower and indirect: the software around a solar system is ordinary software. Installer portals, fleet inventory scripts, monitoring dashboards, mobile apps, utility facing IEEE 2030.5 servers and the container images that run them are built from open source dependencies. Safeguard scans repositories, container images and SBOM files for known vulnerable components, shows which projects carry a given component and version, and can open fix pull requests when a fixed version exists, with autonomous remediation switched off by default.

A solar system's software keeps changing long after the modules are bolted down: every rebuild of a monitoring service or installer app pulls its dependencies again, and inverter gateways and utility protocol servers ship web servers, TLS libraries and parsers from open source projects. The fit is indirect for the hardware itself, but for the open source code you build and ship around it, the same remediation habits apply.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session: it installs the CLI, opens the interactive terminal and asks it to fix a lodash CVE in a repository. It reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, prints a summary and pushes nothing. The same flow applies to an installer portal or a solar monitoring dashboard your team maintains: scan the repository, then let the assistant propose the dependency upgrade under your approval.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code and then scans from the terminal. That suits teams that build gateway software, fleet inventory tools or IEEE 2030.5 server images on their own hardware and want the scan to run where the build runs.

Click through it at your own pace, or open it full screen.

The third demo is a real Android session: send work to a computer running the CLI and approve the command on the phone with Allow once, Allow for turn or Deny. For an engineer on call for a fleet monitoring service, that means a dependency fix can be approved from a phone without anything running unattended.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

Quick check

Sources

• US DOE, Solar Photovoltaics Supply Chain Deep Dive Assessment (24 February 2022, PDF)
• US DOE, Solar Manufacturing
• US DOE, Solar Photovoltaic Cell Basics
• US DOE, Solar Integration: Inverters and Grid Services Basics
• US DOE, Solar Cybersecurity
• US DOE CESER and EERE, Cybersecurity Considerations for Distributed Energy Resources on the U.S. Electric Grid (October 2022, PDF)
• Fraunhofer ISE, Photovoltaics Report (version dated 14 July 2026)
• Fraunhofer ISE, Photovoltaics Report full text (PDF)
• Feldmann et al., Industrial TOPCon Solar Cells Realized by a PECVD Tube Process, 37th EU PVSEC, September 2020 (PDF)
• OSTI, Page et al., Well Passivated a-Si:H Back Contacts for Double-Heterojunction Silicon Solar Cells (2006)
• NLR, Best Research-Cell Efficiency Chart
• NLR, Photovoltaic Lifetime Project
• OSTI, Jordan and Kurtz, Photovoltaic Degradation Rates: An Analytical Review
• NLR System Advisor Model help, PVWatts system design (module types and temperature coefficients)
• IEC webstore, IEC 61215-2:2021, Terrestrial photovoltaic (PV) modules: Design qualification and type approval, Part 2: Test procedures
• IEC webstore, IEC 61730-1:2023, Photovoltaic (PV) module safety qualification, Part 1: Requirements for construction
• IEEE SA, IEEE 1547-2018
• IEEE SA, IEEE 2030.5-2023
• SunSpec Alliance, SunSpec Model Definitions repository
• SunSpec Alliance, Common model definition (model_1.json)
• California Public Utilities Commission, Rule 21 Interconnection
• NIST CSRC, NIST IR 8498, Cybersecurity for Smart Inverters (December 2024)
• NIST IR 8498 full text (PDF)
• IEA PVPS, Snapshot of Global PV Markets 2025

Last reviewed: 23 October 2026.